OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables

Summary

Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables

Current Maintainer Triage

• Normalized severity: medium
• Assessment: v2026.3.28 also misses the broader package, registry, compiler, Docker, and TLS env family in the shipped host-env policy, and the unreleased main fix means this is a real medium-severity open issue.

Affected Packages / Versions

• Package: openclaw (npm)
• Latest published npm version: 2026.3.31
• Vulnerable version range: <=2026.3.28
• Patched versions: >= 2026.3.31
• First stable tag containing the fix: v2026.3.31

Fix Commit(s)

• eb8de6715f02949c21c4e895fffc8a6dcb00975c — 2026-03-31T19:37:43+09:00

OpenClaw thanks @tdjackey for reporting.